4

I've recently been given the task of securing a small network. One of the things we want to have happen is to have the computers lock down after a period of inactivity.

The easy thing for this, of course, is to require a password after the computer goes to sleep or the screen saver starts. The only problem is that I have users unchecking this, as it's a user preference (they don't need to authenticate as an admin to turn it off).

I know I can log them out after a period of inactivity, but that closes all files and programs and is a bit more of a pain for everyone. If I could just have the password prompt all the time, we'd be satisfied.

Is there a way to make the user preference "require password to wake computer from sleep or screen saver" only editable to an admin account?

The clients in question are using 10.5.8.

Thank you for any help you can provide.

Improve this question
6
  • I don't understand your problem. When our users leave their computer on for 3 minutes without action, it changes to the login screen. When you enter your credentials, the users desktop and applications return as they were, when the mac switched to the login screen. I don't understand the unchecking problem, where do they uncheck what ?! What is the final task you wan't to accomplish ?
    – 1amtoo1337
    Mar 19, 2012 at 16:46
  • 2
    The password on screen saver/sleep can be turned off by the user under the security preference pane without any sort of elevated privileges. I want to ensure it remains enabled and NOT allow the user to turn it off (without admin privileges).
    – edeneye
    Mar 19, 2012 at 16:50
  • Yes you're right it's user configurable but I think you can restrict it by setting it as User Level Enforced. Check this link jamfnation.jamfsoftware.com/discussion.html?id=3117 and as far as your question goes I was not saying that it weren't a valid question. I don't get it why people over here a re so defensive, I was just trying to understand your problem.
    – 1amtoo1337
    Mar 19, 2012 at 16:54
  • 1
    Wasn't being defensive at all, just answering your question to the question. Emphasis was for clarity only.
    – edeneye
    Mar 19, 2012 at 18:40
  • 1
    I really love the answer below as a creative solution, but since you are already running Server.app, you could also just enable Profile Manager (or use other methods to use a profile/.mobileconfig) and then set the option in the profile, and/or you could go one step further and not allow your network users to reach the "Securtiy & Privacy" settings at all. Could follow up with lots of details if needed.
    – forgotstackxpassword
    Apr 28, 2016 at 21:54

1 Answer 1

Reset to default
3

Although I have concerns about recommending this solution, you can change the access permissions for the Security (or Security & Privacy) preferences pane itself so that only the Administrator account, or members of the Administrator group, will be able to open that pane.
[ᔥ Owen Linzmayer: Require Password to Wake 2005]

I want to emphasize that I have not fully tested this solution and that you should proceed with caution and do your own testing before implementing it across an entire production environment. It seems innocuous enough, but experience has taught me that changes in places that Apple does not intend you control can sometimes have consequences.

You can set permissions for the pane using the terminal, or by navigating to the /System/Library/PreferencePanes folder:

image of Go to Folder dialog box

Selecting the Security pane file:

image of contents of PreferencePanes folder

do a Get Info using the menu, contextual menu or ⌘ + i and change the permissions for everyone to no access. You will most likely have to click the lock in the lower-right-hand corner and authenticate with your administrator password before you can edit the permissions.

image of Get Info for Security PrefPane

Improve this answer
2
  • This looks like it might work. A repair permissions would probably reset it, but I'm not sure anyone here would go through that trouble. I'd prefer to let them see (but not change) the preference pane versus an error, but this looks like a good alternative if I can't find out how to do it any other way.
    – edeneye
    Mar 19, 2012 at 18:42
  • I agree, it wouldn't be my first choice either. But we have to work with the toolbox we're given. Keep us posted!
    – jaberg
    Mar 19, 2012 at 18:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .